Every Syself Autopilot component reports its own metrics on a small web endpoint. Whether Prometheus can reach that endpoint depends on where the endpoint binds. This page lists each component, its port and scheme, and which of two collection methods reaches it.

The endpoints fall into two groups. Some sit on the pod network, where an ordinary scrape reaches them. The rest bind only to 127.0.0.1 on the node, which keeps their metrics private to that machine.

127.0.0.1 is the loopback address, and binding to it keeps an endpoint off the network. Inside a pod, 127.0.0.1 means the pod itself, not the node, so an ordinary scrape cannot reach a node's loopback endpoint. A host-network collector runs on the node itself, so it can.

Every endpoint on this page is collected by the System Alloy , which runs on each node's own network namespace and therefore reaches both groups. Your own workloads are the exception: they go to the Application Alloy instead, for the reasons in Using Alloy for observability .

This page is the inventory. For what the series from each component actually tell you, see Control-plane metrics and Data-plane and cluster component metrics .

Reachable on the pod network#

These expose metrics through a Service or their pod IP, so any collector on the pod network reaches them. The System Alloy scrapes the ones running on its own node, which spreads the work across agents without scraping any endpoint twice.

Reachable only over the node's loopback#

Most of these bind to 127.0.0.1, so only a collector sharing the node's network namespace reaches them. The kubelet is the exception: it listens on the node IP, not loopback, but the host firewall admits port 10250 only from other nodes and the metrics-server pod, so an ordinary Prometheus pod is dropped and the same agent reaches it over the node's own loopback. The scheme column below is whether the endpoint serves plain HTTP or HTTPS, and whether it needs a token.

The Nodes column is also the gating rule: a job for a control-plane-only or worker-only component has to be restricted to those nodes, or it fails permanently on the rest.

Not scrapeable#

• Cilium Envoy's metrics listener is disabled at the platform level (its metrics on port 9964 are turned off and it does no L7 proxying here), so it exposes no metrics.
• GPU nodes ship no GPU metrics on their own. To get GPU utilization and memory, install the NVIDIA DCGM exporter yourself and scrape it like any application metric.

For the full port inventory, including non-metrics listeners, see Ports and listeners .